How to use count for activity updates

[jsalsbur]

Good morning
I am working on a Splunk dashboard where there's a site with 15 different firewall rules. I want to set up a single number that auto updates and shows that the rules are all active.
So it would be green at 15 and anything less, 14 -1 would should as yellow,
technically I would like if it drops before the half to go red but I'm fine with green and yellow for now.

I am doing index=firewallindexname sourcetyp=firewallsourcetype sensor=rule1 OR sensor=rule=2 and so on
This is where I hit the brick wall, I wanna do count- but not the count of the firewall rules used- just the fifteen different ones if they are active.

[jsalsbur · Accepted solution]

found my own answer, just use stats count, not stats count by.....

thanks